CVE-2026-126570

Padloc versions 4.0.0 before 4.3.1 are vulnerable to a prototype pollution vulnerability within the ScimServer._handleScimUsersPatch() function. By sending crafted SCIM PATCH paths —specifically paths such as __proto__.x or constructor.prototype.x—to the setPath() method, authenticated SCIM token...

EUVD-2026-123084

Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer.handleScimUsersPatch. Attackers can supply paths like proto.x or constructor.prototype.x passed to setPath to pollute...

PT-2026-144953

Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer. handleScimUsersPatch. Attackers can supply paths like proto .x or constructor.prototype.x passed to setPath to pollut...

CVE-2026-126570: padloc: Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify…

Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer.handleScimUsersPatch. Attackers can supply paths like proto.x or constructor.prototype.x passed to setPath to pollute...

CVE-2026-121454

Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer.handleScimGet that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve...

CVE-2026-121454 Padloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requests

Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer.handleScimGet that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve...

CVE-2026-121454

Padloc versions through 4.3.0 are vulnerable to a missing authentication flaw in the ScimServer._handleScimGet() function. This vulnerability allows unauthenticated attackers to bypass security by providing any non-empty bearer token. If an attacker knows an organization ID, they can query the Us...

CVE-2026-121454

Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer.handleScimGet that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve...

CVE-2026-121454 Padloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requests

Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer.handleScimGet that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve...

EUVD-2026-115886

Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer.handleScimGet that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve...

CVE-2026-121454: padloc: Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows…

Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer.handleScimGet that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users and Groups SCIM endpoints to retrieve...